Electric scooters (“e-scooter”) have been rapidly gaining popularity worldwide as one of the micro-mobility transportation modes. Their swift adaptation to the cities owing mostly to their easy use and efficiency also raised legitimate concerns in terms of safety, sufficiency of public infrastructures, and smooth running of the traffic flow. The regulators worldwide amend or introduce regulations to give a legal definition for e-scooters to determine their status in the traffic and public areas as well as the rules applicable to their use and operations of e-scooter sharing businesses.
The legal framework on e-scooters has been developed with the initial step of announcing the Draft Regulation on Shared E-Scooter Businesses (“Draft Regulation”), made by the Ministry of Transport and Infrastructure (the “Ministry”) on 13 September 2020. The Draft Regulation is one of the outcomes of the Micro-Mobility Focus Group Meetings held with the participation of the stakeholders in the sector. The Draft Regulation covers multiple areas within the authority of different governmental bodies which led to a need for codification. The Grand National Assembly of Turkey recently passed a bill amending certain laws to introduce underlying principles and definitions for e-scooters with the Law on Establishment of the Turkish Environment Agency and Amendment of Certain Laws numbered 7261 on 24 December 2020 (“Amendment Law”) which is on hold for the approval of the Presidency of the Republic of Turkey.
In light of these new developments, we will discuss the requirements contemplated for the Turkish e-scooter market, and further analyze data privacy concerns that come with e-scooter applications. Before doing so, we will also briefly explore the market trends in micro-mobility transportation and legal concerns leading to the regulative efforts of national and local authorities for e-scooters.
Overview of the Micro-Mobility Market
The micro-mobility market on a global scale has witnessed a swift expansion, especially after introduction of dockless e-scooters which allowed a new and easy transportation experience for the users. After the introduction of Bird on September 2017 in the US market, it has reported reaching 10 million rides within only a period of one year, having stretched its operations to 100 cities. One of its competitors, Lime, has announced surpassing 150 million rides worldwide after three years of its launch. In the last few years, many other players have joined the market and micro-mobility transportation in many different jurisdictions and attracted investments from financial investors, and other ride-sharing and automotive companies.
The e-scooters, among other players in the micro mobility market, continue to be in demand, as they offer an environmentally friendly option open for innovations, while attracting users for short distance travels particularly efficient in urbanized areas. According to pre-COVID 19 analyses, it was estimated that the micro-mobility market had the potential to reach 300 billion US Dollars by 2030. Although travel restrictions and other circumstances created by COVID-19 pandemic have reportedly caused a decline in micro-mobility transportation, user habits seem to incline towards e-scooters instead of public transportation or shared rides to follow social distancing guidelines. In consideration of its advantages, there are expectations for recovery of the micro mobility solutions in the medium and the long run. In fact, the United Kingdom is known to accelerate its regulative efforts for e-scooters to provide alternative means of travel in response to the decreased public transportation capacity occurred due to COVID-19 pandemic.
Turkey, upon its introduction to the first e-scooter sharing business in the first quarter of 2019, now has multiple alternatives serving in Istanbul, Ankara, İzmir and other cities. The Ministry of Transportation and Infrastructure of the Republic of Turkey has recently stated that there are 35 thousand e-scooters in use by more than 3 million citizens in Turkey, by also noting an increase in demand to alternative means to public transportation during COVID-19 pandemic and the expectation that e-scooters worldwide will increase by six-fold during the next four years.
The Need for a Regulatory Framework
Although having its advantages, increasing numbers of e-scooters in public spaces comes with challenges that call for a need of establishing a regulatory framework. An e-scooter ride gets the users from point A to B, but there are multiple legal obstacles on the way for regulators to address. These include in particular, the safety of e-scooter users, pedestrians and traffic flow, allocation of public infrastructure such as sidewalks, bike lanes, streets and motorways to e-scooters. As most e-scooters are without docking stations, their parking spots tend to cause congestions and decrease accessibility on the sidewalks. In addition, membership models and the use of location tracking technologies via e-scooter applications require attention to the processing of personal data by the service providers.
In consideration of these, national and local authorities in many countries have been working on regulating e-scooters with varying levels of strictness in the last years. The United Kingdom, for example, adopted a proactive approach and planned e-scooter trials that will go on for 12 months to gather evidence to be used as guidance if and how e-scooters will be legalized. In the Netherlands, the e-scooters were banned upon occurrence of a fatal electric cart accident in 2018, later to become legalized with strict restrictions in place and only for some models which receive type approvals from the Dutch authorities. France, after encountering with several accidents some unfortunately resulting in death, legally classified e-scooters as personal light electric vehicles and adopted rules to ensure their safe use.
The measures applied by countries worldwide mostly include insurance requirements, speed limits, mandatory gears and equipment, access bans to certain areas such as sidewalks and/or cycleways, age restrictions, and licensing of the users and/or the service providers.
Regulating E-Scooter Businesses in Turkey
In Turkey, e-scooters have been allowed with no specific regulation applicable to the users or service providers so far. This lack of regulation did not go unnoticed by local and national authorities as the e-scooters in traffic became more frequent, especially in Istanbul, where e-scooters are considered to present a viable option in the constant traffic congestion. In furtherance, Istanbul Metropolitan Municipality had taken the first step towards regulating the e-scooters under the E-Scooter Shared Systems Directive. However, it was unanimously rejected by the Transportation Coordination Center (UKOME).
Eventually, in order to have standardized rules for the e-ccooter sector and ensure safety, the Ministry has announced on 13 September 2020 that the initial aspects of the Draft Regulation are established. As the Draft Regulation covers multiple areas within the authority of different governmental bodies which led to a need for codification, the Amendment Law has been put into the agenda of the Grand National Assembly of Turkey to prepare the statutory ground for the Draft Regulation by amending certain laws, including the Road Traffic Law numbered 2918, Environment Law numbered 2872 and Law on Municipal Incomes numbered 2464. The Amendment Law is passed by the Grand National Assembly on 24 December 2020 and waiting for the approval of the Presidency of the Republic of Turkey.
Although the full content of the Draft Regulation is not released to public, the principles being introduced in the Amendment Law as well as the Ministry’s comments and other information at hand give an overall idea on what the businesses should expect as outlined below.
Licensing Criteria for the Businesses
It is understood that the businesses will need to obtain a license to provide e-scooter sharing services under the Draft Regulation. Certain criterion will be sought for the businesses to be eligible to receive such license, such as:
- Having a minimum share capital of TRY 500,000
- Having a minimum number of e-scooters (two thousand for import vehicles and one thousand for domestic vehicles)
- Provision of the services via a mobile application
- Having servers localized in Turkey
Traffic Safety Measures
The Road Traffic Law numbered 2918 to be amended by the Amendment Law will suggest that only the electric scooters which reach up to 25 kilometers per hour are considered as e-scooters. Users will also need to be at least 15 years of age, and there will be designated routes for the users similar to the rules applicable for bicycles. For example, it will be mandatory to use e-scooters on bicycle lanes if available, and even in their absence, users will not be allowed on roads with a maximum speed limit above 50 km/hours and intercity roads and pedestrian ways. It is further prohibited to have loads or passengers on e-scooters except for personal items carried on back.
Further, it is expected that the e-scooters will be required to have registered license plates under the Draft Regulation. Also, there will be measures for the use of e-scooters, including protective gear requirements and other measures for safety of the pedestrians, especially the elderly and persons with disabilities.
Incentives for Using Domestic Resources
It is signaled that the use of domestic software, hardware and vehicles will be encouraged, the details of which are not yet revealed. One example is that minimum number of e-scooters required for obtaining a business license will be lower if the vehicles are domestic production.
Pricing Tariff for Park Spaces
The Amendment Law, if it is enacted in its current state, will amend the Law on Municipal Incomes to regulate the tariff for e-scooter parking spaces, which will prevent unequable applications between different municipalities.
The above information is based on the current version of the Amendment Law, and initial comments of the Ministry regarding the Draft Regulation. Therefore, there may be variations or new subjects in the enacted versions of the Amendment Law and the Draft Regulation. For accuracy of information, we will be further publishing updates once developments are officially made public.
Privacy Concerns Coming with E-Scooter Use
E-scooters came into our lives with new mobile phone technologies. In order to use e-scooters, downloading a mobile phone application is required. By using this application, the nearest available e-scooter can be located. Then, the user should scan the QR code of the e-scooter to the smartphone application. When the QR code is scanned, a password is sent to the user so the e-scooter can be physically unlocked and can start to be used. At the end of the trip, the e-scooter is again locked by the user to a safe area.
Besides the other concerns covered above, this new way of mobility also raises many privacy concerns that should be considered while designing e-scooter services.
Most, if not all, of the e-scooter applications currently running require a membership to provide their services. Without providing personal data, users may not take benefit from the services, in other words, providing personal data is compulsory for receiving the service. Although there is no specific regulation for e-scooter services, as they are processing personal data of the users during membership including the user’s Turkish ID number or otherwise photos of passport or other identification documents, Law on Protection of Personal Data No. 6698 (“DP Law”) shall be applicable.
As a first issue, the data set collected during the membership shall be assessed with respect to the data minimization principle and only necessary personal data which is adequate and relevant for the purposes of the processing should be collected and processed by e-scooter companies.
Another issue is the live location tracks for e-scooter companies. Users’ trips are tracked by the e-scooter company with the GPS data from the scooter and from the smartphone application installed. Therefore, e-scooter companies must identify the legal basis for their data processing and obtain explicit consent, if necessary.
Users’ locations may also be tracked even when the location bottom is turned off, as some applications automatically store time-stamped location data without asking for target advertisement. Tracking the user when not on a trip and storing or transferring such data is risky and has no valid legal reason. Since, personal data shall be collected for specified, explicit and legitimate purposes. This type of processing will constitute a breach of DP Law.
The third issue is the technical vulnerabilities of e-scooter technology. E-scooters communicate with the smartphone application using Bluetooth Low Energy spectrum and/or using the Internet. Use of these communication channels also renders the data exchanges vulnerable to malicious attacks with suitable hardware or software. In recent research, e-scooters were found vulnerable to eavesdropping, man-in-the-middle and replay attacks, denial-of-service, spoofing and fuzzing attacks. In this case, e-scooters shared by many users are an open target for malicious attacks as they are supposed to be easily accessible. As this is the case, companies must develop new technologies or technical security measures to prevent any data breach concerning the software and the hardware.
Finally, data localization approach of the Draft Regulation may raise concerns for the business model of both foreign and local providers that has intentions to enter in the Turkish market. Transfer of personal data abroad is strictly regulated by the DP Law. As stated, the Draft Regulation will also require user data to be kept in Turkey unlike the United Kingdom and France. The United Kingdom and France are one of the first countries that regulate e-scooters. As the General Data Protection Regulation (known as “GDPR”) allows free flow of the personal data within the EU, there is no localization restriction applicable for France and the United Kingdom. In this sense, if the e-scooter company uses cloud computing for providing services, cloud servers should be in Turkey. This being the case, it should be noted that the Constitutional Court of Turkey has previously awarded that regulating the protection of personal data cannot be delegated to the executive branch without first drawing the general framework by the legislative branch. The legal ground for this decision was Article 20 of the Constitution that stipulates that “protection of personal data can only be regulated by the laws”. Considering this decision, banning the transfer of personal data by a regulatory act of administration may be challenged since DP Law specifically brings provisions for the transfer of personal data abroad and allows cross border data transfer as and when the conditions are satisfied.
Even in the case, that data localization is deemed lawful, the required technical security measures should be taken at all stages while obtaining and storing personal data such as cryptographing, setting up firewalls and antivirus software, optimizing the system on a regular basis, and backing up the systems and taking any other data protection and loss prevention measures.
In conclusion, the use of the e-scooter raises many privacy concerns. At that point, the legal framework of processing activities should be determined carefully and principles of privacy by design must be followed as e-scooters seem to be spread even more widely.
Micro-mobility solutions are presenting themselves a promising market open to developments, even though short-term expectations may have fallen below the expected promises due to the special circumstances created by the COVID-19 pandemic. Regardless, the market is anticipated to be recovered in the medium and long term. It is observed that micro-mobility transportation is on the agenda of many countries and mostly encouraged as part of their efforts to reduce the size of carbon footprints.
These being the case, local and national authorities worldwide expectedly stepped in to draw a legal framework. Turkey, being one of them, already has taken the step forward with the Amendment Law and is soon expected to enact the Draft Regulation. Therefore, the service providers that are already in operation or intend to launch in Turkey will need to comply with these licensing and regulative requirements on the local scale. We will be providing further information on the Draft Regulation, once the full content is revealed.
In any case, it should be highlighted that the service providers must always observe the DP Law regardless of whether the Draft Regulation is enacted. At this point, it is essential that the business models are designed upfront to address any data privacy concerns and continuously monitored in each development phase.
 The Constitutional Court of Turkey, Decision No 2014/74 dated 9.4.2014, available in Turkish at http://www.kararlaryeni.anayasa.gov.tr/Karar/Content/94117278-50ca-4203-88f3-72a5537258a5?excludeGerekce=False&wordsOnly=False